Description
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list.
Recommendation
Update the webpack package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.49.0, < 5.104.0
- Patched version(s): 5.104.0
References
Could your website be exposed too?
SmartScanner can check your website for webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior - CVE-2025-68458
- Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
- axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header - CVE-2025-69202
- Papra HTTP redirect bypass can lead to SSRF via webhook delivery system - CVE-2026-48051
You might also like:
See something that needs correcting? Let us knowUpdated February 06, 2026